local_unbound failing to resolve after switching jails to VNET

Hi,

I migrated a couple of jails from shared IP to VNET on FreeBSD 14.1 and now local_unbound inside the jails can't resolve anything. The host resolves fine.

My jail.conf for the VNET jail:

  myapp {
      vnet;
      vnet.interface = "epair0b";
      exec.start = "/bin/sh /etc/rc";
      exec.stop = "/bin/sh /etc/rc.shutdown";
      mount.devfs;
      allow.raw_sockets;
  }

Inside the jail, /etc/resolv.conf points to 127.0.0.1 (local_unbound) and the service is running. But dig @127.0.0.1 google.com just hangs and times out. If I change resolv.conf to point directly at 1.1.1.1, everything works.

So local_unbound is listening but can't reach upstream forwarders. I checked pf rules on the host and DNS traffic from the epair isn't being blocked as far as I can tell.

I compared what the jail sees versus what outside resolvers return using https://dnsrobot.net/dns-lookup and the external results come back instantly, so it's definitely a local issue between unbound and the VNET bridge.

Is there a known gotcha with local_unbound inside VNET jails? Do I need to reconfigure the forwarder addresses or is there a routing issue with the epair interface?

Thanks